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March 13, 2017 


Mr. Jeff Karberg 

Office of the Attorney General 

ATTN: Security Breach Notification 

200 St. Paul PL 

Baltimore, MD 21202 

Re: Data Breach Incident Response 

Nature of Security Breach: Spoofed/Fraudulent Email Request for W-2 

Date of Incident: February 27, 2017 

Number of Maryland Residents: one (1) 

Nature of Pll: W-2 (Name, address, SSN, etc.) 

Dear Mr. Karberg: 

Pursuant to the Maryland Personal Information Act, we are writing to inform you about an 
unfortunate data breach incident that occurred last month. 

What happened ? 

On Feburary 27, 2017, we discovered unauthorized access to one employee record via email 
"spoofing" from an unauthorized user. Email spoofing is the forgery of an email header so 
that the message appears to have originated from someone or somewhere other than the 
actual source. As a result of this criminal act, the unauthorized access resulted in the release 
of information that we store in connection with tax preparation, including name, address 
and the employee's social security number. 

As soon as this access was discovered to be false, we notified the employee and had our 
information security team launch an immediate internal investigation into the matter. To 
date, the individual or organization or specific method that caused the unauthorized access 
has not been identified. 

On March 6, 2017, our employee notified us that he received a letter from the Comptroller 
of Maryland advising that a tax return was filed in his name; thereby indicating that his 
personal information had been compromised and misused. 
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To ensure our employee's financial security and to mitigate future possible misuse of this 
personal information, we have taken the following actions: 


1. We have provided our employee with credit monitoring services through LifeLock 
for the next three (3) years at no charge. This service notifies the employee if and 
when changes occur to his credit files and monitors the following public records: 
Change of Address, Court Records and Social Security number trace through all 
three credit bureaus. It also provides him with proactive fraud assistance to help 
with any questions that he might have. 

2. We supplied our employee with IRS Form 14039 (an affidavit) that his accountant 
will be filing along with our employee's 2016 tax return. 

3. We have filed notification reports with the following government agencies: 

a. Federal Trade Commission (FTC) 

b. Social Security Administration (SSA) 

c. MD State Attorney General's office 


We take our responsibilities to protect personal information very seriously. We are deeply 
disturbed by this situation and have apologized for the concern and inconveniences to our 
employee. 


Sincerely, 





Patricia A. Ramsay , 
Chief Operating Officer 



